Senior Information System Security Manager (ISSM)

About the role

This position directly supports DISA-provided capabilities and services for the Defense Information Systems Agency (DISA). The ISSM will oversee the cybersecurity posture of DoD information systems, ensuring compliance with DoD security standards and protecting sensitive data. The role involves developing and implementing security policies, conducting risk assessments, managing system accreditations (RMF), and leading continuous monitoring efforts while collaborating with cross-functional teams and program stakeholders.

Responsibilities

• Manage the Risk Management Framework (RMF) lifecycle for supported systems to achieve and maintain Authority to Operate (ATO) accreditation.
• Provide ISSM, FISMA, and certification and accreditation support for systems and associated components.
• Conduct recurring assessments of security controls and documentation in eMASS and PPSM to verify accuracy, compliance, and readiness.
• Manage whitelist records, address vulnerabilities identified through recurring IAVM scans, and develop Plans of Action and Milestones (POA&Ms) as required.
• Maintain eMASS control records and POA&Ms in accordance with ATO conditions, approval requirements, and remediation timelines.
• Coordinate cybersecurity activities supporting interim and final authorization to test and operate, including assessments, mitigation planning, patch validation, implementation tracking, and status reporting.
• Create and deliver cybersecurity test plans, test reports, implementation plans, security technical configuration documentation, vulnerability assessment reports, and authorization package materials.
• Lead cybersecurity governance and reporting activities, including development and maintenance of system architectures, requirements, security plans, protection plans, IAVA actions, and IA-related objectives.
• Prepare program documentation, evidence, and briefings for DISA OAB reviews and support the team throughout the review process.

Core Qualifications

• Bachelor’s Degree with 8+ years of experience or Master’s degree with 6+ years of experience; additional experience may substitute for a degree.
• CISSP, CISM, or similar cybersecurity certification.
• In-depth knowledge of DoD cybersecurity policies, frameworks, and compliance standards (e.g., NIST 800-53, RMF, FISMA, ICD 503, JSIG).
• In-depth experience with network systems and building/maintaining an ATO for enterprise computing information systems.
• Experience with system security engineering, risk management, and vulnerability assessments.
• Strong understanding of network security, security controls, and common cybersecurity tools (e.g., firewalls, IDS/IPS, SIEM, endpoint protection).
• Ability to work independently and collaborate effectively with cross-functional teams.
• Strong communication skills, including creating and presenting detailed security reports to stakeholders.
• US Secret clearance required.

Preferred Qualifications

• Experience managing security for complex DoD programs or mission-critical systems.
• Experience with security tools for vulnerability scanning, penetration testing, and security auditing.
• Advanced security certifications (e.g., CISA, CEH, CSSP).
• Experience with configuration management and change management processes in a secure environment.
• Experience with automation and the continuous ATO (cATO) process.

Pay

The Leidos pay range for this job level is $107,900.00 – $195,050.00. Additional factors considered in extending an offer include responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.